{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/1169","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/1169/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/1169/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/1169/events","html_url":"https://github.com/aspnet/Security/issues/1169","id":218112989,"number":1169,"title":"Make IsAjaxRequest overridable or configurable","user":{"login":"TomGroeneboer","id":2950614,"avatar_url":"https://avatars3.githubusercontent.com/u/2950614?v=3","gravatar_id":"","url":"https://api.github.com/users/TomGroeneboer","html_url":"https://github.com/TomGroeneboer","followers_url":"https://api.github.com/users/TomGroeneboer/followers","following_url":"https://api.github.com/users/TomGroeneboer/following{/other_user}","gists_url":"https://api.github.com/users/TomGroeneboer/gists{/gist_id}","starred_url":"https://api.github.com/users/TomGroeneboer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TomGroeneboer/subscriptions","organizations_url":"https://api.github.com/users/TomGroeneboer/orgs","repos_url":"https://api.github.com/users/TomGroeneboer/repos","events_url":"https://api.github.com/users/TomGroeneboer/events{/privacy}","received_events_url":"https://api.github.com/users/TomGroeneboer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-03-30T08:04:09Z","updated_at":"2017-03-30T08:07:12Z","closed_at":null,"body":"Hi guys,\r\n\r\nWe are using the Cookie authentication in our application. This application makes use of API requests (as you do) and therefore the redirect to a login page is silly on these requests. However, we do not use jquery in our front-end. This causes the non-standard header `X-Requested-With` not to be set and that causes the API calls to redirect to the login page. \r\n\r\nIf we want our API requests to return a 401 instead of the redirect, we need to override the behavior in the [`OnRedirectToLogin`](https://github.com/aspnet/Security/blob/rel/1.1.1/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieAuthenticationEvents.cs#L41), [`OnRedirectToLogout`](https://github.com/aspnet/Security/blob/rel/1.1.1/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieAuthenticationEvents.cs#L75), [`OnRedirectToAccessDenied`](https://github.com/aspnet/Security/blob/rel/1.1.1/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieAuthenticationEvents.cs#L58) and [`OnRedirectToReturnUrl`](https://github.com/aspnet/Security/blob/rel/1.1.1/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieAuthenticationEvents.cs#L91) events. \r\n\r\nCould you please make the [`IsAjaxRequest`](https://github.com/aspnet/Security/blob/rel/1.1.1/src/Microsoft.AspNetCore.Authentication.Cookies/Events/CookieAuthenticationEvents.cs#L104) method overridable or make the behavior configurable in another way?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/290334467","html_url":"https://github.com/aspnet/Security/issues/1169#issuecomment-290334467","issue_url":"https://api.github.com/repos/aspnet/Security/issues/1169","id":290334467,"user":{"login":"devatwork","id":1484868,"avatar_url":"https://avatars3.githubusercontent.com/u/1484868?v=3","gravatar_id":"","url":"https://api.github.com/users/devatwork","html_url":"https://github.com/devatwork","followers_url":"https://api.github.com/users/devatwork/followers","following_url":"https://api.github.com/users/devatwork/following{/other_user}","gists_url":"https://api.github.com/users/devatwork/gists{/gist_id}","starred_url":"https://api.github.com/users/devatwork/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devatwork/subscriptions","organizations_url":"https://api.github.com/users/devatwork/orgs","repos_url":"https://api.github.com/users/devatwork/repos","events_url":"https://api.github.com/users/devatwork/events{/privacy}","received_events_url":"https://api.github.com/users/devatwork/received_events","type":"User","site_admin":false},"created_at":"2017-03-30T08:07:12Z","updated_at":"2017-03-30T08:07:12Z","body":"Making this configurable sounds good to me. One cannot always control the client and the header was never standardized. Also I've seen wild proxies eating this header.\r\n\r\nThe API change can be made non-breaking right?"}}
{"actor":{"display_login":"devatwork"}}